0fb6f51a83dead8cf3824ada1648f8bdd169bdfa2e358111f295b8fee3283e5e

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 23:15

Target

0fb6f51a83dead8cf3824ada1648f8bdd169bdfa2e358111f295b8fee3283e5e.dll
Size

66KB
MD5

08dfcaa81a8e4a92ba103c50385058d0
SHA1

5d76a8e5c101704a9820dec1254b76cda06bd337
SHA256

0fb6f51a83dead8cf3824ada1648f8bdd169bdfa2e358111f295b8fee3283e5e
SHA512

cee5f42b5d526a58d484f7db610fda91dbf1e334c1e641c7868a0766688bed1790fd00ffa425a2deb6adc3cb35fceba2fc742b1ba7effec8e8d61d91d1f78ea7
SSDEEP

1536:BnkD/Fw4NACYmSZxaroMNo+dAphnJerW7HNMarrBh0:5kDtjKCa6NInJeoNMaro

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fb6f51a83dead8cf3824ada1648f8bdd169bdfa2e358111f295b8fee3283e5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fb6f51a83dead8cf3824ada1648f8bdd169bdfa2e358111f295b8fee3283e5e.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download